Splunk Search

Combine multiple searches with no relation in one table

igschloessl
Explorer

I have different count searches that I want to show in one report so I can send it to me as a csv file.

index=proxy host=server1 | stats count as output1
| append [search index=mail host=server2 | stats count as output2] 
| append [search index=fw host=server3 | stats count as output3]
| table output1 output2 output3

This output generates 3 columns and three rows. How can I put the count values in one row?
I couldnt update a picture so I tried to make a table:

output1 | output2 | output3
123----------------------------

-------------576---------------
---------------------------38

Tags (3)
0 Karma
1 Solution

493669
Super Champion

Hi @igschloessl ,
try this:

|stats values(*) as *

It will get all values in single row

View solution in original post

0 Karma

493669
Super Champion

Hi @igschloessl ,
try this:

|stats values(*) as *

It will get all values in single row

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...